picard3
LOW
maintainer SamWhited
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source is a tarball from the official project's release infrastructure (data.musicbrainz.org), which is plausibly owned by the project despite not being on a standard host; building from official source is normal AUR practice and poses low risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a tarball from the official project's release infrastructure (data.musicbrainz.org), which is plausibly owned by the project despite not being on a standard host; building from official source is normal AUR practice and poses low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:46
source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Sam Whited <sam@samwhited.com>
2
# Contributor: David Runge <dvzrv@archlinux.org>
3
# Contributor: Gaetan Bisson <bisson@archlinux.org>
4
# Contributor: Mateusz Herych <heniekk@gmail.com>
5
# Contributor: sysrq
6
7
_pkgname=picard
8
pkgname="${_pkgname}3"
9
pkgver=3.0.0rc3
10
pkgrel=1
11
pkgdesc="Official MusicBrainz tagger"
12
arch=(x86_64)
13
url="https://github.com/metabrainz/picard"
14
license=(GPL-2.0-or-later)
15
provides=(picard)
16
conflicts=(picard)
17
depends=(
18
glibc
19
hicolor-icon-theme
20
python
21
python-cffi
22
python-charset-normalizer
23
python-dateutil
24
python-discid
25
python-fasteners
26
python-markdown
27
python-mutagen
28
python-pyjwt
29
python-pyqt6
30
python-tomlkit
31
python-yaml
32
)
33
makedepends=(
34
python-build
35
python-installer
36
python-setuptools
37
python-wheel
38
)
39
checkdepends=(python-pytest)
40
optdepends=(
41
'chromaprint: fingerprinting'
42
'python-pygit2: plugin installation'
43
'qt6-multimedia: media player toolbar'
44
'qt6-translations: full UI translation'
45
)
46
source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
47
sha256sums=('9b40270c47472c8e4a7b8027e9354ccc5746cf1141308a9b3a8567f3cf498480')
48
49
build() {
50
cd $_pkgname-$pkgver
51
PICARD_DISABLE_AUTOUPDATE=1 python -m build --wheel --no-isolation
52
}
53
54
package() {
55
cd $_pkgname-$pkgver
56
python -m installer --destdir="$pkgdir" dist/*.whl
57
install -vDm 644 {AUTHORS.txt,{CONTRIBUTING,NEWS,README}.md} -t "$pkgdir/usr/share/doc/$pkgname/"
58
}
59
60
# vim:set ts=2 sw=2 et:
61
Changes since previous scan
--- PKGBUILD @ 2026-09-14 00:27+++ PKGBUILD @ 2026-09-17 00:27@@ -6,7 +6,7 @@ _pkgname=picard pkgname="${_pkgname}3"-pkgver=3.0.0rc2+pkgver=3.0.0rc3 pkgrel=1 pkgdesc="Official MusicBrainz tagger" arch=(x86_64)@@ -44,7 +44,7 @@ 'qt6-translations: full UI translation' ) source=("http://data.musicbrainz.org/pub/musicbrainz/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")-sha256sums=('095c03e410fd9c66fcf548f160b102332650c4b564281977a1e64f787aa04da6')+sha256sums=('9b40270c47472c8e4a7b8027e9354ccc5746cf1141308a9b3a8567f3cf498480') build() { cd $_pkgname-$pkgverScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 03:15:45 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 17:21:08 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 19:51:22 | Medium | 1 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |